acdl/.ciagent/VERIFY.md

Phase 15 — consumer-repo-and-terraform-apply (v1.2) VERIFY

Verdict: Phase 15: PARTIALLY VERIFIED (terraform apply blocked by IAM) Tag: v1.2.5 Date: 2026-07-21

---

Scope

Phase 15 creates the consumer repo acdl-consumer-microservice with a basic HTTP microservice + Dockerfile, builds the Docker image, and runs the full pipeline through to terraform apply. Requirements: REQ-33 (terraform apply), REQ-34 (consumer repo).

Verification layers

1. Structural

• consumer-repos/acdl-consumer-microservice/{app.py,Dockerfile,README.md} — tiny HTTP server (stdlib, port 8080, returns 200 on / + /health).
• scripts/push_consumer_image.py — ECR repo create + docker login helper.
• adapters/terraform/adapter.py — fixed: ref emission (bare, not ${...}), JSON-string detection (jsonencode), ECS service network_configuration/load_balancer/desired_count/launch_type/task_definition/name, listener default_action/load_balancer_arn, target group target_type/vpc_id/protocol, VPC tags (not name), IGW + route table association emission, managed_policy_arns as list.
• modules-ir/l1/l1-ecs-service/interface.json — removed port from aws:ecs:service sub-resource.
• modules-ir/l1/l1-vpc/interface.json — added intra_refs; removed igw_id output.
• acdl_platform/contract_resolver.py — intra_refs resolution.
• scripts/verify_phase15.sh exists (+x).
• PASS.

2. Behavioral (scripts/verify_phase15.sh)

• Consumer microservice content: PASS.
• Docker image acdl-microservice:latest built: PASS.
• Contract → IR → adapter pipeline: PASS (11 resources).
• terraform validate: PASS (warnings only).
• terraform plan: PASS (13 to add — 11 IR + IGW + RTA).
• Evidence event TERRAFORM_APPLY_BLOCKED in DynamoDB outbox: PASS.
• v1.1 S3 regression: PASS (byte-identical).
• terraform apply: BLOCKED (AccessDenied on ECS/ECR/IAM/EC2 — live IAM policy not updated).

3. Security

• No credentials introduced. The IAM blocker is a security positive: the spike-runner has least-privilege; the policy expansion requires a deliberate privileged action.
• PASS (with documented IAM blocker).

4. Quality

• The adapter fixes address real HCL correctness issues that only surface on the first multi-resource ECS apply.
• The intra_refs mechanism is a clean extension keeping the resolver generic.
• v1.1 S3 regression passes (byte-identical).
• PASS.

P0 / P1

• P0: 1 (BLOCKING — operator action required). terraform apply fails with AccessDenied on all ECS/ECR/IAM/EC2 operations. Root cause: Phase 12's spike_runner_policy.json expansion was committed to the repo but never pushed to the live AWS account (root key deactivated per D-034; spike-runner cannot self-elevate). Unblock: operator with root/admin creds runs ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID=… ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY=… python3 terraform/bootstrap/create_iam_user.py (idempotent). Then terraform apply succeeds (plan is valid, 13 to add). Phase 16 completes the e2e after this unblock.
• P1: 1 (adapter hardening). The adapter's ECS/ALB/VPC emission now includes resource-type-specific defaults (desired_count = 1, launch_type = "FARGATE", target_type = "ip", load_balancer_type = "application", tags = { Name = ... }). Pragmatic for the v1.2 spike; should be parameterized via the L1 interfaces in v1.3.

Requirements covered

• REQ-33: terraform apply (dev, autonomous) — PARTIAL. Pipeline reaches terraform plan successfully (13 to add). The apply is blocked by the IAM policy (P0). Adapter + resolver + L1 fixes complete; only the operator's IAM policy push remains.
• REQ-34: Consumer repo acdl-consumer-microservice with a basic microservice — VERIFIED (content authored under consumer-repos/; Gitea repo creation blocked by missing ACDL_GITEA_TOKEN — documented manual step; content is ready).

Conclusion

Phase 15 is PARTIALLY VERIFIED. Everything up to terraform apply is complete: consumer microservice content, Docker image, adapter fixes, contract→IR→TF pipeline, terraform validate + plan (13 to add). The terraform apply is blocked by the live IAM policy (P0, operator action). The evidence stream captured the TERRAFORM_APPLY_BLOCKED event. Phase 16 will complete the e2e after the operator pushes the policy.